Enrich threat observables with VirusTotal
- Latest Dynatrace
- How-to guide
- Preview
The Dynatrace integration with VirusTotal brings threat intelligence context into alerts and detection investigations to help organizations combat online abuse, such as cyber-attacks, spamming, and other malicious activities.
With observable enrichment with reputation generated from the threat information provided by VirusTotal, you can perform more efficient security investigations and automate alert triaging, reducing the noise with threat-aware prioritization.
How it works
Dynatrace integration with VirusTotal is an app that you can install from Hub.
The app delivers a workflow action for observable enrichment in 
Workflows.
To prevent accidental edits or deletions across environments, connection setup now includes owner-based access control. This ensures reliable automation, avoids unexpected configuration loss, and aligns with minimal access requirements.
For details on sharing and permissions, see Access control for Connectors.
Various consumer apps can perform an on-demand enrichment of observables, for example, via a workflow action.
Dynatrace reaches out to VirusTotal to perform the observable enrichment.
The threat intelligence context is displayed within the consumer apps or in Workflows, helping you drive smarter decisions.
Prerequisites
See below for the VirusTotal and Dynatrace requirements.
VirusTotal requirements
Register with VirusTotal and create an API v3 key.
Dynatrace requirements
The following IAM permissions are required:
app-engine:apps:runapp-settings:objects:readdocument:documents:readsettings:objects:readstorage:system:readsecurity-intelligence:enrichments:run
To run the enrichment workflow action, all the permissions above need to be enabled in Workflows as well.
- Go to the settings menu in the upper-right corner of Workflows and select Authorization settings.
- In Secondary permissions, search for and select the above-listed permissions.
- Select Save.
Get started
-
In Dynatrace, open Hub.
-
Look for VirusTotal and select Install.
-
Select Set up , then select Configure new connection.
-
Follow the on-screen instructions to set up the connection using the API key obtained in Prerequisites.
Allowed outbound connections are extended automatically with
www.virustotal.com.- In Settings, go to Preferences > Limit Outbound Connections.
- Select Add item and add the domain.
- Select Save changes.
-
Test the connection to ensure the correct configuration and save it.
Use cases
Once you set up the VirusTotal integration, you can enrich observables, such as IP addresses, with threat intelligence context.
Key use cases include:
-
IP enrichment directly from investigation results in the Security Investigator app to accelerate threat validation and streamline case triage. For instructions, see Enrich IP addresses.
-
Threat-informed security investigations Coming soon
FAQ
Which observable types are currently supported?
Supported observable types: IP addresses (more coming soon).
How will my VirusTotal API quotas will be affected from this integration?
For every new observable enrichment, we perform a single API call.